Prevent from Adding & Removing record when Parent table condition Met

Interesting Problem.

The title of your post refers to preventing ads or deletes under certain conditions.

A way to prevent Deletes is to replace that with a request deletion checkbox.  Then take away the Permission to Delete from all Roles except Admon.

The have a Pipeline reset the Request Deletion checkbox and then branch to delete the record if the conditions allow.  Perhaps it would write back to a field with a message the date and time and [Last Modified by] (ie who the requested the delete) if the conditions did not allow, so the user would know why their Request Delete Failed.

I can't think of a great way to prevent Add right now.  But you could have a Pipeline trigger when a child record is added and conditions don't allow.  Then the new children would be erased practically as soon as they were entered.

You also might be able to do something either at the FORM level or post save pipeline level by using the parent-child relationship to store the number of "child items" are presently saved and tied to the parent. (#-Children). 

Then in the Parent-Child relationship besure to include both the Parent Status and #-Children 

Remember that a detail record doesn't count as saved until it is saved, so your detail form PREVENTS save before saving with the parent status = approved and the #-Children = x.